# What Bill C-22 would actually require, and why Signal says it would rather leave Canada

> The lawful access bill is now before the Senate. We read the text: what it asks of apps and carriers, what it says about encryption, and who says they'd pull out.

- Published: 2026-11-10T14:58:00.000Z
- By: The Circuit Staff
- Type: Feature
- Topics: Policy, Security
- URL: https://thecircuit.ca/posts/2026-11-10-bill-c-22-lawful-access-explained/

In May, Signal told The Globe and Mail it "would rather pull out of the country than be compelled to compromise on the privacy promises we have made to our users," [the Globe reported](https://www.theglobeandmail.com/politics/article-signal-warns-it-would-pull-out-of-canada-if-made-to-comply-with-lawful/). Six months later, the encrypted messaging app is still saying it. Its vice-president of strategy, Udbhav Tiwari, went on Michael Geist's Law Bytes podcast this week to explain [why Signal may exit Canada](https://www.michaelgeist.ca/2026/11/the-law-bytes-podcast-episode-282-udbhav-tiwari-on-why-signal-may-exit-canada-over-bill-c-22s-encryption-and-metadata-retention-rules/) if the bill passes unchanged.

The bill is C-22, the *Lawful Access Act, 2026*. It passed the House of Commons in June and is now before the Senate's national security committee, which began hearings this month. The Privacy Commissioner testified on Nov. 2.

The fight is loud on both sides. The government calls the bill "encryption-neutral" and says claims that it forces companies to install surveillance tools are "false." Signal, Meta, Apple, Canadian VPN companies and privacy groups say it opens the door to exactly that. So we read the bill as passed by the House. Here's what it would require, what it rules out, and what's still up for debate.

## Where the bill stands

| Date | Stage |
|---|---|
| March 12, 2026 | Introduced by Public Safety Minister Gary Anandasangaree |
| April 20 | Passed second reading, sent to the House public safety committee |
| June 18 | Amended in committee; passed third reading in the House |
| Oct. 22 | Passed second reading in the Senate, sent to the national security committee |
| Now | In Senate committee |

*Source: [LEGISinfo](https://www.parl.ca/legisinfo/en/bill/45-1/c-22).*

The bill has three parts. Part 1 changes how police and CSIS get information about who's behind an account. Part 2 creates a new law, the *Supporting Authorized Access to Information Act*, that tells service providers what they must build so authorities can use the powers they already have. Part 3 orders a parliamentary review three years after it's all in force.

## Part 1: faster access to who you are

Part 1 amends the Criminal Code and the CSIS Act. Its main new tools, per the [bill text](https://www.parl.ca/DocumentViewer/en/45-1/bill/C-22/third-reading) and the [Justice Department's Charter Statement](https://www.justice.gc.ca/eng/csj-sjc/pl/charter-charte/c22_2.html):

- **A "confirmation of service" demand.** Police can require a telecom provider to confirm whether it serves a given person, account or number, without going to a judge, if they have "reasonable grounds to suspect" an offence. The provider gets at least 24 hours to answer, and can be barred from telling anyone about the demand for up to a year.
- **A subscriber information production order.** A judge can order a provider to hand over subscriber information, such as names, identifiers, account numbers and details about devices, also on "reasonable grounds to suspect."
- **Requests to foreign companies.** A judge can authorize police to ask a foreign entity for the same information.

"Reasonable grounds to suspect" is a lower bar than the "reasonable grounds to believe" standard behind most search warrants. That's what has made Part 1 contentious. Privacy Commissioner Philippe Dufresne has [welcomed some House changes](https://www.priv.gc.ca/en/opc-actions-and-decisions/advice-to-parliament/2026/parl_261102/) but wants "subscriber information" narrowed to a fixed list of identifiers, and the production order limited to telecom providers. At the Senate hearing, he said the order could otherwise reach "health care providers, lawyers, financial institutions and dating apps," [according to Geist's account](https://www.michaelgeist.ca/2026/11/surveillance-by-design-government-officials-say-lawful-access-could-reach-gaming-platforms-daycares-and-ai-services/).

Part 1 takes effect 180 days after royal assent.

## Part 2: building access into services

Part 2 is where Signal's objections lie. The government's [backgrounder](https://www.canada.ca/en/public-safety-canada/news/2026/03/backgrounder--securing-access-to-information-in-bill-c-22.html) frames it as overdue: Canada relies on "a 1995 condition of license that only covers voice telephony," and help from other services is "entirely voluntary." Part 2, it says, "does not create new authorities" to intercept anything.

What it does create, per the bill text:

- **A very broad definition.** An "electronic service provider" is anyone who provides an electronic service "to persons in Canada" or does business here. That covers far more than phone companies.
- **"Core providers."** Cabinet can put classes of providers on a list and require them to build, test and maintain "operational and technical capabilities" to extract information and give it to authorized officials, and to install equipment that may enable access. **The list is empty in the bill.** Cabinet decides later, by regulation, who goes on it.
- **Metadata retention.** Regulations can require core providers to keep categories of metadata for up to **six months**. The first version said up to a year; the House committee cut it. Content, web browsing history and social media activity are excluded.
- **Ministerial orders.** The public safety minister can order *any* provider, listed or not, to do anything the regulations could require, for up to two years. Each order needs approval from the federal Intelligence Commissioner. A provider can't reveal what an order contains, or even that it got one, unless the minister allows it.
- **Penalties.** Administrative penalties of up to $50,000 for individuals and $250,000 for companies, per violation, with each day counting as a new one. Offences carry fines of up to $100,000 and $500,000.

How broad "any provider" could be came up at the Senate's first hearing. Shannon Hiegel, a federal director general for national and cyber security, said the definition "would include things like gaming platforms where communication isn't the primary purpose," and a Justice lawyer said an order "could be a daycare in some cases," [Geist reports](https://www.michaelgeist.ca/2026/11/surveillance-by-design-government-officials-say-lawful-access-could-reach-gaming-platforms-daycares-and-ai-services/). Anandasangaree called the term "deliberately broad," while saying expanding to other platforms "is not what is immediately envisioned."

## The encryption question

The bill has two clauses meant to answer the encryption worry.

First, a provider "is not required to comply" with a regulation or order if it would mean introducing a **"systemic vulnerability"** or keeping one from being fixed. Second, nothing in Part 2 compels a provider to decrypt anything its users encrypted, "unless the encryption was provided by the electronic service provider and the provider possesses the information necessary to decrypt" it. The House added that second clause in June. Dufresne told senators the change means Part 2 now precludes requirements to decrypt end-to-end encrypted information, which he called a positive step.

The government's spokesperson says the bill "expressly protects end-to-end encrypted information where a provider does not possess the means to decrypt it," [the Globe reports](https://www.theglobeandmail.com/politics/article-tech-vpn-companies-call-for-changes-to-lawful-access-bill/).

Critics' concerns centre on the definition. A systemic vulnerability is one that creates a credible risk that secure information could be accessed by someone without authority, "other than a risk that relates only to information related to persons" covered by a warrant or order.

*Our analysis:* that exception matters. A capability built to expose only the people named in a warrant wouldn't count as a systemic vulnerability under that wording, even though security engineers generally argue that any built-in access path can be found and abused by others. And the decryption clause covers decrypting existing messages, not being ordered to change how a service works going forward. This is the gap Signal points to. "End-to-end encryption is incompatible with exceptional access, no matter how creative the route taken to achieve it," Tiwari said in May. Meta [told the House committee](https://about.fb.com/news/2026/05/metas-position-on-canadas-bill-c-22/) the bill could require companies to "build or maintain capabilities that break, weaken, or circumvent encryption," and asked Parliament to split Part 2 off and tighten the definition to rule out weakening encryption or client-side scanning.

The government's side is that the definition and the review steps exist precisely to stop that. A ministerial order needs the Intelligence Commissioner's sign-off, and the minister must weigh feasibility, cost, and the impact on privacy and cybersecurity before making one.

## Who says they'd leave

- **Signal** is the clearest: it would rather leave than be compelled to weaken its encryption.
- **Windscribe**, the Toronto VPN company, said the House amendments weren't enough to keep it here. "Bill C-22 makes Canada an untenable place for most tech companies to operate in, foreign and domestic," CEO Yegor Sak said, [per the Globe](https://www.theglobeandmail.com/politics/article-tech-vpn-companies-call-for-changes-to-lawful-access-bill/).
- **Tailscale**, which says about 40 per cent of its global team is in Canada, intends to stay Canadian but said it might have to restructure to distance its international operations from Canada. It also noted that moving wouldn't solve the problem, since the bill covers any service offered to people here.
- **Meta** and **Apple** have warned about the bill but haven't said they'd withdraw. Apple has said it could let the government force companies to break encryption "by inserting backdoors into their products," [Geist notes](https://www.michaelgeist.ca/2026/05/bill-c-22s-groundhog-day-why-the-governments-dismissal-of-signal-apple-and-the-u.s.-congress-concerns-runs-back-the-disastrous-online-news-act-playbook/); Meta's committee remarks contain no exit threat.

Critics, Geist among them, point to the U.K. as a preview. Its *Investigatory Powers Act* lets the government issue "technical capability notices" that can include obligations to remove "electronic protection," including to operators [outside the U.K.](https://www.legislation.gov.uk/ukpga/2016/25/section/253) Apple has since [stopped offering](https://support.apple.com/en-us/122234) its Advanced Data Protection encrypted backups to new U.K. users. "We have never built a backdoor or master key to any of our products or services and we never will," Apple said. A Canadian version of that outcome would mean a feature switched off here, not necessarily an app gone.

## What to watch

- **Senate amendments.** The national security committee is still hearing witnesses. If senators amend the bill, it goes back to the House. OpenMedia is [petitioning senators](https://openmedia.org/) to reform it, and the Privacy Commissioner wants independent expert assessments of provider obligations, as in the U.K., Australia and New Zealand.
- **Royal assent.** Part 1 kicks in 180 days later. Part 2 starts only when Cabinet says so.
- **The regulations.** Who goes on the "core provider" list, what capabilities they must build, and which metadata they must keep all depend on regulations that don't exist yet. Officials told senators the first phase would "probably take 18 months to two years" after royal assent, Senator Denise Batters said in [Senate debate](https://www.michaelgeist.ca/2026/10/years-of-uncertainty-bill-c-22s-missing-regulations-and-secret-ministerial-orders/).
- **Secret orders.** Ministerial orders are confidential by default. The government's backgrounder promises an annual report with a public version, which will be the only window on how often they're used.

**Why it matters:** Most of what Canadians would notice depends on decisions not yet made: who Cabinet lists as a core provider, and what orders the minister issues in secret. The bill now rules out forced decryption of end-to-end encrypted messages, but it leaves open whether a service can be ordered to change how it's built. That's the question that decides whether Signal, and the VPNs and developer tools built here, stay. The Senate is the last chance to change the wording.